Bug 1926386

Summary: setfiles fails on file /etc/.ip with ext4 immutable bit set
Product: Red Hat Enterprise Linux 8 Reporter: Petr Lautrbach <plautrba>
Component: policycoreutilsAssignee: Petr Lautrbach <plautrba>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact: Khushbu Borole <kborole>
Priority: medium    
Version: 8.4CC: dwalsh, jafiala, lersek, lvrabec, mmalik, plautrba, rjones, ssekidde, vmojzis
Target Milestone: rcKeywords: Triaged
Target Release: 8.0   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
.`setfiles` does not stop on labeling error Previously, the `setfiles` utility stopped whenever it failed to relabel a file. Consequently, mislabeled files were left in the target directory. With this update, `setfiles` skips files it cannot relabel, and as a result, `setfiles` processes all files in the target directory.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-05-18 15:09:18 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Petr Lautrbach 2021-02-08 18:54:29 UTC
Either `setfiles` should not abort when it's not not able to set a new context, or it should provide an option which would on suppress aborting on labeling errors.

Simple reproducer:

$ mkdir -p r/1/1 r/1/2
$ sudo chown root: r/1/2
$ mkdir -p r/2/1 r/2/2
$ setfiles -v -r r /etc/selinux/targeted/contexts/files/file_contexts r
Relabeled r from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:root_t:s0
Relabeled r/1 from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:default_t:s0
Relabeled r/1/1 from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:default_t:s0
setfiles: Could not set context for r/1/2:  Operation not permitted

See https://bugzilla.redhat.com/show_bug.cgi?id=1794518 for more details

Comment 11 errata-xmlrpc 2021-05-18 15:09:18 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (policycoreutils bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1715

Comment 12 Laszlo Ersek 2022-04-27 09:27:25 UTC
The upstream fix for this seems to be commit 9207823c8ff0 ("setfiles: Do not abort on labeling error", 2021-02-01).